
where \(\Pi \)  is the projection operator on the set \(\Delta \) , and \(\alpha \)  is the step size of PGD.
Instead of the gradient, one often uses the gradient sign update for \(\operatorname{\mathbf {\ell }}_\infty \)  perturbations or the \(\operatorname{\mathbf {\ell }}_2\)  normalized update for \(\operatorname{\mathbf {\ell }}_2\)  perturbations.
\(\delta ^{(0)}\)  can be initialized as any point inside \(\Delta \) , e.g. as zero,
or randomly [1]}.
